Merge lp://staging/~therp-nl/therp-backports/server-6.1-lp1070884-apply_rule_after_write into lp://staging/therp-backports/server-6.1

The fix appears simple enough, but it will prevent some use cases that we want to allow, as discussed on the bug report.

It also constitutes an important change in the way access control is implemented, and as such it seems to me that it directly breaks our policy for stable series of only allowing bugfixes with a very low risk/benefit ratio.
I think this change belongs to trunk exclusively, even after being reviewed according to the bug comments.

Thanks for taking the time to create the 6.1 branch though, some users (including yourself apparently) might still want to use this as a custom patch for some of their customers.

Oh I initially thought that this was a merge proposal againt the 6.1 server. Linking bug reports to multiple projects and having mixed branches confused me, sorry :-/ Feel free to ignore my comment of course!

This is a very serious change and with possibly using Therp's backports as a start for community branches we shouldn't ask for trouble. For now, I disapprove and propose to return to this issue later.

Concerning the inconsistency: I see that too. But it's more complicated than that. With the same reasoning, we'd have to check write rules after create: Why can't I modify a resource to property A when I can create one with that property?

A proper fix is imho doing what you and Olivier proposed earlier, 'write' checks before write, a new rule type 'post_write' checks after write.

Holger,

glad you said that. I missed this one in my retraction of dubious changes.